@meshconnect/web-link-sdk 3.1.8 → 3.1.9

package/Link.js

@@ -51,29 +51,29 @@ import { isWalletBrowserEventTypeKey } from './utils/wallet-browser-event-types'
 import { sdkSpecs } from './utils/sdk-specs';
 import { WalletStrategyFactory } from './utils/wallet';
 var currentOptions;
-var possibleOrigins = new Set([
-    'https://web.meshconnect.com',
-    'https://dev-web.meshconnect.com'
-]);
+var targetOrigin;
+var linkTokenOrigin;
 var iframeElement = function () {
     return document.getElementById(iframeId);
 };
 function sendMessageToIframe(message) {
-    possibleOrigins.forEach(function (origin) {
-        var _a;
-        var iframe = iframeElement();
-        if (!iframe) {
-            console.warn("Mesh SDK: Failed to deliver ".concat(message.type, " message to the iframe - no iframe element found"));
-            return;
-        }
-        try {
-            (_a = iframe.contentWindow) === null || _a === void 0 ? void 0 : _a.postMessage(message, origin);
-        }
-        catch (e) {
-            console.error("Mesh SDK: Failed to deliver ".concat(message.type, " message to the iframe"));
-            console.error(e);
-        }
-    });
+    var _a;
+    var iframe = iframeElement();
+    if (!iframe) {
+        console.warn("Mesh SDK: Failed to deliver ".concat(message.type, " message to the iframe - no iframe element found"));
+        return;
+    }
+    if (!targetOrigin) {
+        console.warn("Mesh SDK: Failed to deliver ".concat(message.type, " message to the iframe - no target origin found"));
+        return;
+    }
+    try {
+        (_a = iframe.contentWindow) === null || _a === void 0 ? void 0 : _a.postMessage(message, targetOrigin);
+    }
+    catch (e) {
+        console.error("Mesh SDK: Failed to deliver ".concat(message.type, " message to the iframe"));
+        console.error(e);
+    }
 }
 function handleLinkEvent(event) {
     return __awaiter(this, void 0, void 0, function () {
@@ -345,7 +345,7 @@ function eventsListener(event) {
         return __generator(this, function (_a) {
             switch (_a.label) {
                 case 0:
-                    if (!!possibleOrigins.has(event.origin)) return [3 /*break*/, 1];
+                    if (!(event.origin !== targetOrigin && event.origin !== linkTokenOrigin)) return [3 /*break*/, 1];
                     console.warn('Received message from untrusted origin:', event.origin);
                     return [3 /*break*/, 5];
                 case 1:
@@ -382,10 +382,11 @@ export var createLink = function (options) {
             }
             currentOptions = options;
             linkUrl = window.atob(linkToken);
+            linkTokenOrigin = new URL(linkUrl).origin;
             window.removeEventListener('message', eventsListener);
             addPopup(linkUrl, currentOptions === null || currentOptions === void 0 ? void 0 : currentOptions.language);
             window.addEventListener('message', eventsListener);
-            possibleOrigins.add(window.location.origin);
+            targetOrigin = window.location.origin;
             return [2 /*return*/];
         });
     }); };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meshconnect/web-link-sdk",
-  "version": "3.1.8",
+  "version": "3.1.9",
   "description": "A client-side JS library for integrating with Mesh Connect",
   "exports": "./index.js",
   "license": "MIT",

package/utils/version.d.ts

@@ -1 +1 @@
-export declare const sdkVersion = "3.1.8";
+export declare const sdkVersion = "3.1.9";

package/utils/version.js

@@ -1 +1 @@
-export var sdkVersion = '3.1.8';
+export var sdkVersion = '3.1.9';